Trojan.DownLoader35.61035

Malicious functions

Modifies settings of Windows Internet Explorer

[<HKCU>\Software\Microsoft\windows\CurrentVersion\Internet Settings] 'ProxyOverride' = '<Local>'

Modifies file system

Creates the following files

%TEMP%\tfr6bad.tmp
%APPDATA%\video downloader(xmlbar)\appdata\xmlbarver.ini.part
%LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\index.dat
%APPDATA%\microsoft\windows\cookies\low\index.dat
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\kjmln2o9\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\3w7vi75j\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\km1za5d7\desktop.ini
%APPDATA%\video downloader(xmlbar)\config\flvrules.initmp.part
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\u2yalbd0\desktop.ini
%LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
%LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
%LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012020112020201121\index.dat
%APPDATA%\video downloader(xmlbar)\config\domain.ini.part
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
%APPDATA%\video downloader(xmlbar)\config\flvrules.initmp1

Sets the 'hidden' attribute to the following files

%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\u2yalbd0\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\km1za5d7\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\3w7vi75j\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\kjmln2o9\desktop.ini
%LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini

Deletes the following files

Moves the following files

from %APPDATA%\video downloader(xmlbar)\config\domain.ini.part to %APPDATA%\video downloader(xmlbar)\config\domain.ini
from %APPDATA%\video downloader(xmlbar)\appdata\xmlbarver.ini.part to %APPDATA%\video downloader(xmlbar)\appdata\xmlbarver.ini
from %APPDATA%\video downloader(xmlbar)\config\flvrules.initmp.part to %APPDATA%\video downloader(xmlbar)\config\flvrules.initmp
from %APPDATA%\video downloader(xmlbar)\config\flvrules.initmp1 to %APPDATA%\video downloader(xmlbar)\config\flvrules.ini

Network activity

TCP

HTTP GET requests

http://www.4h##.com/xbdomain2.php?13##########################
http://13#.#24.238.147/favicon/cntv.png
http://13#.#24.238.147/favicon/sohu.png
http://13#.#24.238.147/favicon/letv.png
http://13#.#24.238.147/favicon/youtube.png
http://13#.#24.238.147/favicon/tudou.png
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
http://13#.#24.238.147/favicon/youku.png
http://pa#####.#ooglesyndication.com/pagead/js/adsbygoogle.js
http://13#.#24.238.147/api_rule14.php?la##########
http://13#.#24.238.147/favicon/qq.png
http://13#.#24.238.147/images/searchbox.png
http://www.xm##ar.net/qvideo.php?la##########
http://13#.#24.238.147/videover3.php?la#############################
http://13#.#24.238.147/images/oaqrcode.jpg
http://13#.#24.238.147/images/logo09429.jpg
http://13#.#24.238.147/api_histad.php?la##########
http://13#.#24.238.147/images/top.gif
http://13#.#24.238.147/images/initclose.gif
http://13#.#24.238.147/include/script_common.js
http://13#.#24.238.147/api_video60.php?ty###################################################################
http://13#.#24.238.147/images/wechatscan.jpg
http://13#.#24.238.147/images/textbg.gif